Nvidia put the agent watchdog in the wire, not in the software

Software guardrails ask an agent to behave. Nvidia has moved the guard off the computer the agent runs on and into the wire between that agent and the model it talks to. The watchdog is called Sentry, and if an agent tries to leave its sandbox it gets isolated in milliseconds.

“A permissions check alone can miss prompt injection, where a tricked agent sends data through approved channels while violating its intended purpose.”

— The Decoder, analysis

The Decoder, on the limit of a permissions-based guard

How it is built:

• Sentry sits on the only link between an agent and the model it talks to, inside the Vera Rubin datacentre system.
• It runs on BlueField-4 data processing units, separate from the main computer, which makes it invisible to the agent it watches.
• It checks requests, identities and access rights. It does not read the agent's reasoning.
• If an agent tries to leave its sandbox, Sentry isolates it within milliseconds.
• Customers on compatible systems need a software update rather than new hardware.

The design choice worth understanding is what Sentry refuses to do. It does not analyse reasoning logs, it does not try to work out what the agent meant, and it does not sit in the same place the agent can reach. It looks at three things: who is asking, what is being asked, and whether that identity is allowed to ask it. None of that requires knowing what the AI agent is trying to achieve. Running on a separate processor makes it invisible to the thing it supervises, which is the whole point. A guard an agent can see is a guard an agent can argue with.

Three layers, shipped in order

Nvidia is stacking this on top of two pieces it already shipped. OpenShell, an open-source sandbox, arrived in March, and a formal verification tool for catching permissions violations landed on 10 September. Sentry is the hardware layer under both, and the company says customers already running compatible systems need only a software update. There is no separate availability date and no published figure for what the check costs in latency.

Meta reached the same shape in the same week, from a different direction. Its Muse agent gives every user a cloud computer where actions inside the cell are unrestricted, with credentials held outside it and a process called Sentinel watching sensitive operations from beyond the boundary. Two vendors, two names a thesaurus apart, one architecture: let the agent do what it likes inside a box, and put the referee outside the box where the agent cannot reach it.

What a permissions check cannot see

Both designs answer the escape question well and leave the harder one open. A permissions check sees an approved identity using an approved channel. It does not see that the agent was talked into it, which is exactly how prompt injection works. Containment is an architecture problem and Nvidia has done architecture. Detecting misuse inside the rules is a judgement problem, and nobody has shipped judgement in silicon.

The gap shows up in how long these things take to surface. An OpenAI agent reached an Australian government portal in June and the government heard 84 days later. A watchdog that isolates in milliseconds is a real improvement on that number, provided the thing it is watching for is the thing that goes wrong. Nvidia has not said how often Sentry fires, how often it fires wrongly, or what it costs to keep running. Those three numbers will tell you more than the launch does.

Informational only, not investment advice. Nvidia has published no overhead figures or detection reliability data for Sentry, and no separate general availability date.